Use webfinger for OIDC parameter discovery

[rhafer]

To solve many of the issues our users have with getting OpenCloud to work with different IDPs we
came up with a more generic way for how clients should discover their OIDC setttings (issuer, client_id and scopes). This is described here: https://github.com/opencloud-eu/opencloud/blob/main/docs/adr/0003-oidc-client-config-discovery.md

And implemented in: opencloud-eu/opencloud#2072

Now we need to implement this mechanism in our clients.

[guruz]

Can you ping me when you deployed this on demo.opencloud.eu?
Seems not there yet.
https://demo.opencloud.eu/.well-known/webfinger?resource=https://demo.opencloud.eu/&rel=http://openid.net/specs/connect/1.0/issuer&platform=android (if that's the right way to call it..)

CC @micbar

[micbar]

That will be part of the opencloud 5.2.0 rolling release.

[micbar]

@Svanvith @ScharfViktor can you use our instance launcher to provide an instance for @guruz with the daily release?

[guruz]

thanks a lot. feel free to e-mail me or write me privately on Matrix..

[Svanvith]

@rhafer can you please tell me, what we should enter for

WEBFINGER_ANDROID_OIDC_CLIENT_ID
WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES

Only example config for testing :)

[rhafer]

@rhafer can you please tell me, what we should enter for

WEBFINGER_ANDROID_OIDC_CLIENT_ID
WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES

Only example config for testing :)

AFAIK you already figured it out yourself, but you could e.g. change the client id for the android client in the keycloak example from OpenCloudAndroid to some other value and also set WEBFINGER_ANDROID_OIDC_CLIENT_ID to that value.

To try out custom values for WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES you could set e.g. "openid, profile, email, offline_access, roles". In that case it would be useful to reconfigure Keycloak in a way to not return the roles claim for the android client unless it request the roles scope. (I think I or probably @micbar can help you with that if needed)

[guruz]

=> #104